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We propose a non-deterministic two-way quantum key distribution in which the quantum cor- 
relation is established by transmitting the randomly polarized photon. We analyze the security of 
the proposed quantum key distribution against photon number splitting, impersonation, and Trojan 
horse attack and quantify the security bound against mean photon number of the coherent state 
pulse. Finally, we remark the characteristic features of the protocol. 

PACS numbers: 03.67.-a,03.67.Dd,03.67.Hk 
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Quantum key distribution (QKD) 0, 0, Q is to gen- 
erate shared secret information between distant parties 
with negligible leakage of the information to an eaves- 
dropper Eve. The security of QKD is based on the no- 
cloning theorem: Eve can not extract any information 
without introducing errors Q , while the security of the 
classical key distribution or cryptography is supported 
by the computational complexity of the underling math- 
ematical problems 13. Since the QKD by Bennent and 
Brassard (BB84) [J there has been security proof [B| 
and theoretical proposals to enhance the security Q. 

The Ping-Pong protocol (PP) proposed by Bostrom 
et al. is the first two-way quantum key distribu- 
tion based on entangled qubit. It is a conceptually new 
scheme in the sense that the key is generated by the round 
trip of the qubit, while in the conventional QKD it is done 
with single trip. With this trend, Lucamarini et al. [8j 
proposed the two-way protocol without entanglement by 
merging the peculiarities of BB84 and PP and recently, 
Kye et. al., proposed to the three-way QKD [§] to make 
the encoding possible with relatively dense coherent-state 
pulse. One of the interesting aspects of their protocol is 
to use the qubit with random polarization, while in the 
conventional protocol-predefined finite number of polar- 
ization states is used Q, 0, S S @l ■ 

In the multi-way quantum key distribution [3, HI, El, 
the fact that the final key is led by only one party which 
allows creating the key in deterministic way is consid- 
ered as an advantage for the direct encoding. However 
in some cases the deterministic feature of QKD without 
dissipation of the qubit often provides Eve with the room 
to track the protocol easily HI, 3j- That is to say the 
deterministic feature can play a role of potential security 
hole in QKD. 

In this paper, we propose a non-deterministic two-way 
QKD in which the quantum correlation is established by 
transmitting the randomly polarized photon. The initial 
random polarization \6) with arbitrary 9 € [0, it] is com- 
pensated by acting the unitary operator U(—9) on the 
returning qubit and the net encoding information can be 
extracted from that. In addition, the non-deterministic 
feature comes from the N number of screening angle 
which is chosen by Alice at the initial stage of the proto- 



col. The key is created only when the matching condition 
of the corresponding screening angles is satisfied and it 
plays important role in blocking up the impersonation 
and Trojan horse attack. 

QKD using coherent-state pulse has received much 
attentions in regard to the practical implementation 
[E S EH- Since there is no phase reference outside 
Alice or Bob's lab, a coherent-state \^/Jle 10 ) of mean 
photon number /i is effectively described by photon 
number eigenstate \n) with Poission distribution: 
= exp(— Li/2)^/Jl n /Vnl.\n) [ijj]- As we shall see, our 
proposal has remarkable advantages for implementation 
using coherent-state pulse, because the protocol allows 
not only to transmit the relative dense coherent pulse 
but also to increase the raw key creation rate. Our 
protocol is described as follows: 

Protocol: 

(P.l) Alice and Bob initiate the protocol by announcing a 
set S(N) which has N number of screening angles, 



S(N) = {ai, • --a N }, 



(1) 



where N > 2 and the screening angle on is defined 
as on = iir/ (N + 1). 

(P.2) Alice take arbitrary angle 6 and chooses screening 
angle a a and random screening factor s £ {0, 1}. 
She prepares the qubit: 



£>0s«a) 



(2) 



where <5„ 



1 for p = q otherwise S pq — 0. Al- 



ice occasionally takes 9 with the probability c as 
a predefined value 9* £ {0,7r/2} which is called 
authentication angle. If 9 = 9* then the proto- 
col follows the authentication mode (A-Mode) else 
transmission mode (T-Mode). 

(A-mode 1) Bob chooses a screening angle ab- He acts 
?7((— l) fc 7r/4+ab) on the received qubit, where 
k is key bit. The qubit becomes 



\9* + {-l) k Tr/A + S 0s a a + a b ), 



(3) 
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The fraction (1 — t) of the photons in the qubit 
enter into the Bob's detector, where t is the 
transmission efficiency of Bob's detector. Bob 
records the outcome Ob in his detector. 

(A-mode 2) After acting U(—9* + 5i s a a ) on the returning 
qubit, Alice has the qubit \(—l) k ir /4+ab+a b ) . 
She measures the qubit and the outcome is 
recorded as O a . 

(A-mode 3) Alice declares the mode is A-mode, then Alice 
and Bob announce the chosen screening angles 
a a and a b , respectively. If the screening angles 
satisfy that 



a b 



(4) 



then the qubit incoming to Bob's detector is 
\8* + (-l) fe 7r/4). So the corresponding out- 
come Ob and encoded key k are correlated by 



O b = k®(26*/ic), 



(5) 



where © is the addition on mod 2 space. If 
the verification is failed, Alice and Bob imme- 
diately terminate the protocol and initiate the 
protocol form (P.l) later. If a a + ab ^ tt in 
above step Alice and Bob return (P.2). 

(T-mode 1) Bob chooses a screening angle ab- He acts 
U({-l) k x/4+a b ) on the received qubit, where 



k is key bit. The qubit becomes 
|6» + (-l) fe 7 r/4 + ( 5 0s a a + a b ). 



(6) 



Bob returns the qubit to Alice. 

(T-mode 2) Alice acts U(— 6 + Si s a a ) on the returning 
qubit and it becomes | ( — l) fc 7r/4 + a a + ab). 
Alice measures the qubit and gets the outcome 
O a . 

(T-mode 3) Alice and Bob announce the chosen screening 
angles a a and ab respectively. If the screening 
angles satisfy that a a +ab — 7T, then Alice gets 
the key k for the outcome O a : 



O a = k, 



(7) 



else Alice and Bob go to (P.2). If the desired 
key length is created then go to (P.3) 

(P.3) Alice and Bob create key k a and kb by concatenat- 
ing key bits and exchange the hash values h(k a ) and 
h(kb) @. If h(k a ) = h(kb) then the key creation is 
finished else Alice and Bob start again from (P.l). 

Eq. (5) shows Alice's integrity condition observed in 
Bob's detector(DO, Dl in Fig. 1), which plays an im- 
portant role to detect lethal strategy like impersonation 
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FIG. 1: Schematic diagram for the experimental setup. DO 
and Dl: Bob's detectors; D3 and D4: Alice's detectors; PBS: 
Polarization Beam Splitter. Bob has equipped the optical 
filter to reject undesired frequency. 



and Trojan Horse attack. Even though the key encod- 
ing is performed by Bob deterministically, the final key 
is rearranged whether the matching condition in Eq. (4) 
is satisfied or not. In the QKD the raw key creation 
rate depends on the number of screening angle and mode 
probability as 



R r 



inkTjdet •> 



(8) 



where q depends on implementation (q ~ (1 — c)/N for 
our protocol), f rep is pulse rate, izmfc the transmission 
and rjdet the detection efficiency Now, we shall 

analyze the security of the protocol. 

Security against photon number splitting (PNS) attack: 
Since A-mode is only for authenticating purpose, it is 
enough to consider that Eve's attack is focused on the 
T-mode in quantifying the PNS attack As usual, 

we assume that Eve is so superior that her action is lim- 
ited only by the law of physics. Against the coherent 
state \y/JI) from Alice, she replaces the lossy channel by 
a perfect one and puts a beam splitter of transmission 
efficiency 77 in the middle [l(| ■ The reflected field, which 
is a coherent state with its amplitude — rj*Jp), will 
be the source of information to Eve. In the protocol 
(T-mode. l)-(T-mode. 3), the information transmitted be- 
tween Alice and Bob is of random polarization. In our 
protocol, the photon polarizations lie on the equator of 
the Poincare sphere. Thus, in this case, Eve's goal is to 
find the optimum state estimation from n qubits gives 
the maximal mean fidelity given by [Tt| : 



I(n) 




(9) 



Let us first consider the maximum information Eve can 
get from the Alice— > Bob channel in (a.2). The probabil- 
ity of there being n photons of the channel in the coherent 
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state |^(1 - rj)n) is Pab{ti) = exp[-(l - n)^i] i 
The received qubit in Bob's end is \y/rfjl) an( A after 
transmission of the detector, it becomes \^/rjtjJ). Thus 
in Bob — > Alice channel, the probability of there be- 
ing n photons in the coherent state — rj^/rjtp) is 
P BA (n) = exp[-(l - v) ^ 1 '^ 



Then the maximum amount of information Eve can 
get from the channel in A— >B and B— >A is Iab = 
Y^n=o p AB(n)I{n) and I B a = Y,n=o p BA{n)I{n), re- 
spectively. The maximum information Eve can obtain 
is bounded by Ie = ^^{Iab, Iba), which is plotted in 
Fig. 2 for various cases. Since the intensity of the coher- 
ent pulse decreases as the number of laps between Alice 
and Bob, I E is actually determined by Iba- 

Now we define the critical value of initial amplitude 
a* which gives the average number of photons delivered 
to Alice about 1 after (T-mode 3). Since the incom- 
ing amplitude of the coherent pulse in (T-mode 3) is 
| y/ (1 — rj)r)tn) , the critical value of initial amplitude is 
given by (i* = 1/((1 — 77)774) . At the critical value of 
initial amplitude, maximum bound for Eve's information 



c*p(- 



^-I(n) w 0.6900, while the mutual in- 



1 E ~ l^n=0 

formation between Alice and Bob is unity (if the detector 
of Alice is not clicked in a particular time window due to 
the empty pulse, Alice and Bob could exclude the corre- 
sponding event by announcing that the pulse is empty). 
That is to say, at the critical amplitude Alice and Bob 
shares 31% higher information than that of Eve. So Al- 
ice and Bob could create the final key through the post 
processing like privacy amplification [181 ] . 
We remark the critical mean photon number in our pro- 
tocol is on 5 < /j* < 15 which is at least ten times larger 
value than fj, < 0.2~fl3. 14 1 of conventional QKD. Accord- 
ingly, our protocol allow the higher raw key creation rate, 
even though the q factor in Eq. (9) is slightly smaller that 
the conventional QKD. 

Security against Impersonation attack: 
Eve can impersonate Bob to Alice and Bob to Alice in the 
quantum channel. This type of attack is effective on the 
protocol which transmits the qubit without dissipation of 
the qubit 0, 0| ■ Against our protocol, Eve may consider 
the following strategy: 

(Al.l) After the step (P2) Eve intercepts the qubit and 
puts it in the quantum storage. Let's call it E\ = 
{\9 + 5 ns a a )}. Eve prepare fake qubit \0' + S 0s ia' a ) 
and send it to Bob. 

(Al.2) After the step (A-mode 1) or (T-model), Eve in- 
tercepts again the qubit whose state is given by 
|(-l) fc 7r/4 + 9' + 6 0s >a' a + a b ). Eve gets the qubit 
|(-l) fc 7r/4 + aj,) after acting U(—9' - <Wo4) on 
the qubit. Eve measures the qubit with guessing 
a b = a 'b an d g e t s the outcome O e and key k! = O e . 

(A1.3) Eve encodes the intercepted original qubit E\ by 
acting U((— l) k n / 4 + a' b ) . The intercepted qubit 



becomes E[ = { | (— l) fc ' tt/4 + 6 + S Qs a a + a' b )}. Eve 
sends the qubit to Alice. 

If Eve impersonate the quantum channel during T-mode, 
the probability that Eve's guessing of a b in (Al.2) was 
right is 1/N. Accordingly Alice's key with Eve's imper- 
sonation includes the error with the probability and it 
should be noticed in the step (P.3). 

On the other hand, if Eve impersonates the quantum 
channel during A-mode, Eve's impersonation can be 
also detected at the step (A-mode 3). In the step 
(Al.l), Eve's fake qubit \9' + a' a ) is entered into Bob's 
detector with the transmission efficiency (1 — t). In 
that case, Eve's fake qubit violates with the integrity 
condition of Eq. (5) because the probability that Eve's 
guessing was matched with Alice's authentication angle 
as well as screening, 9' = 9* and a' a = a a is almost null 
(here we use the fact that Eve does not know if the 
protocol in A-mode or T-mode). Eve's impersonation 
should be notice in the step (A-mode 3) with Eq. (5)- (6). 

Security against Trojan Horse type attack: 
Eve could attach ancillary qubit to the transmitted qubit 
and after the Bob's encoding, she reads out the encoding 
by measuring the ancillary qubit after separating out the 
ancillary qubit form the unified qubit. It is shown that 
the attack strategy is effective on the multiple- way proto- 
col 0, [HI ■ We assume that Alice has a properly designed 
filter to reject the unnecessary of photons with split wave 
length as in Fig. 1 0] . So Eve has some difficulty to dis- 
tinguish ancillary form the full qubit and eventually she 
could not separate out the ancillary qubit form the uni- 
fied qubit, perfectly. Nevertheless, to demonstrate the 
robustness of our protocol, we allow Eve to inject the an- 
cillary qubit which has split wave length compared with 
the transmitted qubit and to separate the ancillary qubit 
from the returning qubit. 

Eve may consider the strategy as follows: 

(A2.1) After the step (A-mode 1) or (T-mode 1), Eve pre- 
pares an ancillary state |0) and attaches the ancil- 
lary onto the qubit from Alice. The qubit with the 
ancillary state is \9 + So s a a ) <8> |0). Eve sends the 
qubit to Bob. 

(A2.2) After the step (A-mode 1) or (T-mode 1), the re- 
turning qubit becomes |(— l) k Tr/4+9+8o s a a +ab)® 
|(— l) fe Tr/4 + at,). Eve separates out ancillary and 
keep the qubit in storage as E2 — {|(— l) fe 7r/4 + 
a;,)}. After the step (A-mode 3) or (T-mode 3), 
Eve knows the Bob's screening angle a b and mea- 
sures the qubit in A\ and reads the key k. 

If Eve can distinguish if the protocol is in either T-mode 
or A-modc. Eve attacks on the protocol only when the 
protocol is in T-mode. In that case, she can read the 
key in the fraction of t of the created key, because the 
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FIG. 2: Maximum bound for Eve's information 1^ as a function of mean photon number /i of the coherent-state pulse according 
to various channel transmission efficiency r\ at the transmission efficiency of Bob's detectors t — 0.7 (a) and t = 0.9 (b). The 
horizontal line in (a) and (b) shows the maximum bound of information for Eve when Alice prepares the initial amplitude as 
the critical value [i — fi* . 



ancillary qubit sink into the Bob's detector with the frac- 
tion of 1 — t. Unfortunately, there always exists 9 which 
satisfies 9 + S 0s a a = 9* + 5 0s ia' a , where a a ,a' a S S(N) 
and s, s' G {0, 1} it inevitably induces the collision be- 
tween two mode. Thus Eve can not distinguish the initial 
qubit state if it is in T-mode or A-mode unambiguously 
and she could not avoid to intervening during A-mode 
and her ancillary qubit sink into the Bob's detector. The 
ancillary qubit which does not carry the information Al- 
ice's screening angle and authentication angle makes the 
Bob's outcome 0' b violating the integrity condition. Thus 
Eve's Trojan Horse attack should be noticed in the step 
(A-mode 3). 



CONCLUSIONS 

We have proposed the non-deterministic two-way QKD 
protocol and have demonstrated the security of the pro- 
posed protocol against PNS, Impersonation and Torjan 
Horse attack. Finally, we emphasize that the proposed 
protocol has the following advantages compared with the 
conventional QKD. 1) The quantum correlation is estab- 
lished by exchanging the qubit with completely random 
polarization. For that reason, our protocol can be imple- 
mented with relatively dense coherent pulse. 2) Since the 
mean photon number \x can be safely set is much higher 



non-demolition measurement [ 1 01] and unambiguous state 
discrimination [20], it can be avoided by increasing the 
number of screening angle N. 



value than that of conventional QKD [13j,[lJ] (see the last 
paragraph of PNS analysis), the corresponding raw key 
creation rate is higher than that of the conventional two- 
way QKD. 3) The protocol provides the tunable security 
depending on the number of screening angle N. Even 
if an eavesdropper try to know the current status of the 
protocol by a combination of photon number quantum 
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